Table of Contents

Other Security Headers

X-Frame-Options

This is set to "SAMEORIGIN"

Strict Transport Security

strict-transport-security: max-age=106384710; includeSubDomains; preload

What this does

This tells the browser that this site is using HTTPS - i.e. traffic in encrypted.

Why we do it

HSTS addresses the following threats:
  • User bookmarks or manually types [http://example.com] and is subject to a man-in-the-middle attacker
    • HSTS automatically redirects HTTP requests to HTTPS for the target domain
  • Web application that is intended to be purely HTTPS inadvertently contains HTTP links or serves content over HTTP
    • HSTS automatically redirects HTTP requests to HTTPS for the target domain
  • A man-in-the-middle attacker attempts to intercept traffic from a victim user using an invalid certificate and hopes the user will accept the bad certificate
    • HSTS does not allow a user to override the invalid certificate message
HTTP Strict Transport Security Cheat Sheet

Cache control

The directives

 Cache-control: no-store 
 Pragma: no-cache

Tell the user agent not to cache the response.

These should be set on resources that either change or are sensitive e.g.:

  • API responses which is data that can change
  • files as these may contain sensitive data. These headers should be set on the "filestore" CDN.

They should not be set on images, fonts, javascript and other resources that do not frequently change and are not sensitive. They are not set on the "webresources" CDN.

x-content-type-options: nosniff

This tells the browser that the media type (MultiPurpose Internet Mail Extensions or MIME type) in the headers should not be changed to stop Mime Type Sniffing.

Referrer-Policy

Depreciated security headers

These headers should not be set.